Dep-Man Repository Analyzer Chrome extension security report

Check dependency health before you clone, install, or depend on a GitHub project. Dep-Man analyzes supported dependency files directly from the GitHub repository pages you visit. It shows outdated packages, update urgency, and an overall dependency health score without requiring you to clone the repository or run commands locally. Use it to get a quick, practical view of how actively a project's dependencies are being maintained. Whether you are evaluating an open-source library, reviewing a project before contributing, or checking repositories your team depends on, Dep-Man keeps the relevant package information visible where you already work: GitHub. WHAT DEP-MAN SHOWS Dep-Man detects supported dependency files and compares declared package versions with current versions from public package registries. The analysis includes: Outdated and up-to-date dependency counts. Color-coded urgency indicators ranging from low to critical. An overall repository dependency health score. Current and latest available versions for supported packages. Package-level details that help you identify which dependencies need attention first. Clear error information when a repository, dependency file, package, or registry cannot be analyzed. The results appear directly on GitHub repository pages and repository lists, so you can compare projects without repeatedly switching tools or copying dependency files into another service. SUPPORTED ECOSYSTEMS JavaScript and Node.js projects using package.json, including npm, yarn, and pnpm workflows. Python projects using requirements.txt and packages published on PyPI. Dart and Flutter projects using pubspec.yaml and packages published on pub.dev. Dep-Man can analyze repositories containing more than one supported dependency file. This is useful for projects that combine multiple ecosystems or contain several application components. USEFUL WHEN EVALUATING A REPOSITORY A repository can look active while still relying on old dependencies. Dep-Man adds dependency freshness to the information already available on GitHub, helping you answer questions such as: Are the main dependencies reasonably current? How many packages may require updates? Are the available updates mostly patches and minor releases, or are major upgrades involved? Does the repository contain dependency files from more than one ecosystem? Which packages should I inspect before adopting or contributing to this project? Dep-Man is designed to provide a fast dependency overview. It does not replace release-note review, automated testing, a security audit, or professional vulnerability scanning. Always review breaking changes and test updates before changing production dependencies. WORKS WITH GITHUB NAVIGATION GitHub loads many pages without a traditional full-page refresh. Dep-Man understands this navigation behavior and refreshes its analysis as you move between supported repository pages or switch branches. The extension works on individual repository pages as well as supported repository list views. Areas unrelated to dependency analysis, such as settings, pull requests, issues, actions, security, discussions, and project pages, are excluded from automatic analysis. PRIVATE REPOSITORIES Public repositories can be analyzed without configuring a GitHub token, subject to GitHub's unauthenticated API limits. To analyze private repositories or increase the GitHub API rate limit, you can add an optional GitHub Personal Access Token through the extension side panel. Use a token with only the repository access you need. The token is stored locally in your browser using Chrome storage. It is sent only to api.github.com to authenticate GitHub API requests made on your behalf. It is not sent to the Dep-Man API. HOW ANALYSIS WORKS When you open a supported GitHub page, Dep-Man identifies the repository and looks for package.json, requirements.txt, and pubspec.yaml files through the GitHub API. The contents of supported dependency files are sent over HTTPS to the Dep-Man API at pack-man.tech. The API checks package information against public registries such as npm, PyPI, and pub.dev, then returns the analysis results to the extension. A short-lived local cache reduces repeated requests while you browse. Successful results and temporary errors use separate expiration periods so failed requests can be retried sooner. You can clear the cache from the extension side panel. PRIVACY AND DATA USE Dep-Man does not include advertising, analytics, or usage telemetry. The extension processes GitHub repository information and supported dependency file contents only to provide dependency analysis. Dependency file contents are sent to the Dep-Man API because they are required to compare declared package versions with current registry information. An optional GitHub token remains stored locally in Chrome and is sent only to the official GitHub API for authentication. Dep-Man does not sell user data and does not use repository information for advertising or unrelated purposes. All extension code executed by Chrome is included in the installed extension package. The extension does not download or execute remote JavaScript or WebAssembly. PERMISSIONS EXPLAINED Storage is used for the optional GitHub token, extension settings, custom API endpoint, and short-lived analysis cache. The Chrome side panel is used for configuration, token management, endpoint settings, cache controls, and links to related Dep-Man tools. Access to github.com is required to detect supported repository pages and display analysis results. Access to api.github.com is required to retrieve dependency files and validate the optional GitHub token. Access to pack-man.tech is required to submit dependency information to the production Dep-Man API and receive package analysis results. CONFIGURATION AND TROUBLESHOOTING Open the extension from the Chrome toolbar to access its side panel. From there, you can configure or remove a GitHub token, review the API endpoint, test the connection, and clear cached analysis results. If a repository cannot be analyzed, first confirm that it contains at least one supported dependency file. Private repositories require a token with appropriate access. GitHub API rate limits may also affect requests when no token is configured. For help, bug reports, and feature requests, use the Chrome extension support repository: https://github.com/avencadigital/dep-man-chrome/issues Chrome extension repository: https://github.com/avencadigital/dep-man-chrome DEP-MAN FOR VISUAL STUDIO CODE Want dependency information inside your editor as well? Dep-Man is also available for Visual Studio Code, with workspace analysis, CodeLens indicators, hover details, Problems panel integration, folder exclusions, and dependency update actions. Install from the Visual Studio Marketplace: https://marketplace.visualstudio.com/items?itemName=AvencaDigital.dep-man-vscode Install from Open VSX: https://open-vsx.org/extension/AvencaDigital/dep-man-vscode MORE LINKS Dep-Man website: https://pack-man.tech Open-source Dep-Man API: https://github.com/avencadigital/depman-api Support the project: https://www.buymeacoffee.com/avenca.digital Dep-Man helps you inspect dependency freshness without leaving GitHub, so you can evaluate repositories with better context and focus your attention on the packages that need it most.